Gentlemen Ransomware Uses Advanced Techniques for Network Attacks

• •Gentlemen ransomware uses 21 remote execution techniques for rapid network encryption.
• •The malware is written in Go and employs advanced methods like PsExec and PowerShell Remoting.
• •Its affiliate program has expanded its reach since mid-2025, increasing its threat level.

The Gentlemen ransomware, a Go-based RaaS, has been active since mid-2025 and employs aggressive propagation methods. It utilizes 21 remote execution techniques, including PsExec, WMIC, and PowerShell Remoting, to encrypt entire networks from a single compromised machine. The malware is designed to spread rapidly across corporate environments, posing a significant threat to organizations. Disguised with a tool called Garble, it combines strong encryption with a self-spreading worm engine. The ransomware's affiliate program has expanded its reach, with ties to major breach forums. As of now, organizations are urged to bolster their defenses against this evolving threat.